Overview
Your complete guide to Ethical offence, with permission
The pen testing method from permission and scope to the report, testing web apps in permitted labs, and Active Directory and identity attacks, with how to detect and stop each one.
Non-technical and technical learners alike. Every part opens two ways in: a plain path built on an analogy for someone starting from zero, and a detailed path for someone who knows the basics and wants depth.
An animation, then what you need before you start, then the idea with code you run, then a worked example, then review cards and "test your understanding" questions.
Do not leave a part before you can answer its questions without guessing. Reading alone proves nothing.
Pick a topic
A look at Ethical offence, with permission
You learn the rules before the tools: permission, phases and the report, then apply them to the web, then to the heart of the company network: Active Directory. Every attack is paired with detection and defence.
| Part | Topic | You learn |
|---|---|---|
| 1 | The penetration testing method: permission, scope and the report | Written permission, rules of engagement and scope, kinds of test (black, grey and white box), the phases from reconnaissance to the report, CVSS 4.0 and priority, the report, retesting |
| 2 | Testing web apps in the lab: the proxy, permissions and injection | The intercepting proxy, mapping the app, testing authentication and sessions, permissions and IDOR with two accounts, injection and parameterised queries, SSRF, business logic, the fix and the automatic test, permitted labs |
| 3 | Active Directory and identity: attack paths and how to close them | The domain, the domain controller and groups, Kerberos and tickets, spraying, Kerberoasting, pass-the-hash, DCSync and the golden ticket, tiering and privileged access, LAPS, gMSA and Protected Users, detection events, attack paths as a graph, Entra ID |
Done with this lesson?
Sign in to save your progress.